create-backend-scaffold
A CLI tool to scaffold a production-ready MERN (Express + MongoDB) backend structure in seconds — with optional JWT authentication built in.
This report shows the evidence for create-backend-scaffold@1.1.1. 9 of 9 known versions are blocked or flagged. The newest version, 1.1.2, is blocked. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains a concrete concealed remote-code execution chain unrelated to its advertised scaffolding function. Absence of an install hook does not mitigate execution when its server entrypoint runs.
Decision evidence
public snapshot- `playground/src/routes/auth.routes.js` appends an obfuscated immediately invoked payload after the router.
- The payload dynamically constructs functions, decrypts staged code, and calls `eval`.
- It queries a blockchain JSON-RPC service for transaction data to derive command-and-control data.
- It downloads XOR-decoded code over HTTPS and launches it detached with hidden windows.
- `src/app.js` imports the poisoned route, so `node server.js` activates it at runtime.
- `package.json` has no install lifecycle hook.
- The CLI scaffold writer in `src/utils/fileHelper.js` is otherwise user-invoked and package-aligned.
Source & flagged code
2 flagged · loading sourceTarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to create-backend-scaffold@1.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing create-backend-scaffold@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.